Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-12-2024 16:35
General
-
Target
f4d47479cf0759f04d7a67ddfe48408f_JaffaCakes118.exe
-
Size
28KB
-
MD5
f4d47479cf0759f04d7a67ddfe48408f
-
SHA1
44089a3e8c8667d49eb5e848fc038d58af7f7812
-
SHA256
c3d018ae9755b54e608a0eef4cf6f30a3c166b82dac649e08f9ede8a22745195
-
SHA512
69caad1e8d8d059bce16e833ae8a7fc5872b4aa78025b286705d3acf112f3b7c7c2a7f4d57582d2123f5377c5880c58dac1b43af458c1073a309f7c8fcf8ba13
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNtWtU1:Dv8IRRdsxq1DjJcqf/S
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4d47479cf0759f04d7a67ddfe48408f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f4d47479cf0759f04d7a67ddfe48408f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD5361c6a353ad6d1256f0a335e7ff895d7
SHA18a6bad7c01818e4a45790c2a74dbd16d44e43ef5
SHA256f4840248eda8eaaec50b3bb1d715cc036f24294a360dbbc79a5d6e7dcaa33ace
SHA512c64fcf4ae9787e7720b1c93d95ac6cf5132def1c5b9446db79e8fb7650455363f90c521f6c47bf8bf36b6c62ec61577640dae883c45fb283e77073514fad3caa
-
Filesize
1KB
MD5be7e3e2384c90ebf424bcacd16228969
SHA19b5e2128f78ebe93ffe31a4ee292196955a5ae46
SHA256669a5b9b23d06d112bf1d173fa3b1da34e81943fe41effc8768ca11dccd54f02
SHA5123ea6c6517b13ba47f4433e98400e2e1a52b1a18f96a7615351ff363052ce28fd066d68fe94a4a733ee7c1830c528c928057b56669e7f462e2420e5a0f4a1f674
-
Filesize
1KB
MD581349beab4fe04e684916c838df87509
SHA1ae481728120ea753a7e6d356db4511cad7e5d7c5
SHA2563eff8e24187fd0339c7b0800c5f411a1bc99da823370d8d4a23daca7f0ecd04e
SHA512d6bb5c4426c534ecc14a4676425e0a33593f685bd237d63ff63e50a03481f7788befe20a22ceb4e8d1594dabd920e32366269cffd25afdb02cee920ec4281a82
-
Filesize
1KB
MD5acae01ce5c45368807c4b84b5d1a51ad
SHA1708d4f5fc448d27038eafd2c57259165b16854d6
SHA2568b074d30f6119b2e7174d410007924c1870d542b8c2a09619b98d2efeeb8f5a8
SHA51206e0fc467917b43f2220c4165aa86ce8e7a9f5511abacce91398818742438d605176356a7a0d0b62213edd505e3e9a0afb807e212335334cc594576b57680e14
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB